xref: /freebsd/crypto/openssh/servconf.c (revision c6ec7d31830ab1c80edae95ad5e4b9dba10c47ac)
1 
2 /* $OpenBSD: servconf.c,v 1.229 2012/07/13 01:35:21 dtucker Exp $ */
3 /* $FreeBSD$ */
4 /*
5  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
6  *                    All rights reserved
7  *
8  * As far as I am concerned, the code I have written for this software
9  * can be used freely for any purpose.  Any derived versions of this
10  * software must be clearly marked as such, and if the derived work is
11  * incompatible with the protocol description in the RFC file, it must be
12  * called by a name other than "ssh" or "Secure Shell".
13  */
14 
15 #include "includes.h"
16 __RCSID("$FreeBSD$");
17 
18 #include <sys/types.h>
19 #include <sys/socket.h>
20 
21 #include <netinet/in.h>
22 #include <netinet/in_systm.h>
23 #include <netinet/ip.h>
24 
25 #include <netdb.h>
26 #include <pwd.h>
27 #include <stdio.h>
28 #include <stdlib.h>
29 #include <string.h>
30 #include <signal.h>
31 #include <unistd.h>
32 #include <stdarg.h>
33 #include <errno.h>
34 
35 #include "openbsd-compat/sys-queue.h"
36 #include "xmalloc.h"
37 #include "ssh.h"
38 #include "log.h"
39 #include "buffer.h"
40 #include "servconf.h"
41 #include "compat.h"
42 #include "pathnames.h"
43 #include "misc.h"
44 #include "cipher.h"
45 #include "key.h"
46 #include "kex.h"
47 #include "mac.h"
48 #include "match.h"
49 #include "channels.h"
50 #include "groupaccess.h"
51 #include "canohost.h"
52 #include "packet.h"
53 #include "version.h"
54 
55 static void add_listen_addr(ServerOptions *, char *, int);
56 static void add_one_listen_addr(ServerOptions *, char *, int);
57 
58 /* Use of privilege separation or not */
59 extern int use_privsep;
60 extern Buffer cfg;
61 
62 /* Initializes the server options to their default values. */
63 
64 void
65 initialize_server_options(ServerOptions *options)
66 {
67 	memset(options, 0, sizeof(*options));
68 
69 	/* Portable-specific options */
70 	options->use_pam = -1;
71 
72 	/* Standard Options */
73 	options->num_ports = 0;
74 	options->ports_from_cmdline = 0;
75 	options->listen_addrs = NULL;
76 	options->address_family = -1;
77 	options->num_host_key_files = 0;
78 	options->num_host_cert_files = 0;
79 	options->pid_file = NULL;
80 	options->server_key_bits = -1;
81 	options->login_grace_time = -1;
82 	options->key_regeneration_time = -1;
83 	options->permit_root_login = PERMIT_NOT_SET;
84 	options->ignore_rhosts = -1;
85 	options->ignore_user_known_hosts = -1;
86 	options->print_motd = -1;
87 	options->print_lastlog = -1;
88 	options->x11_forwarding = -1;
89 	options->x11_display_offset = -1;
90 	options->x11_use_localhost = -1;
91 	options->xauth_location = NULL;
92 	options->strict_modes = -1;
93 	options->tcp_keep_alive = -1;
94 	options->log_facility = SYSLOG_FACILITY_NOT_SET;
95 	options->log_level = SYSLOG_LEVEL_NOT_SET;
96 	options->rhosts_rsa_authentication = -1;
97 	options->hostbased_authentication = -1;
98 	options->hostbased_uses_name_from_packet_only = -1;
99 	options->rsa_authentication = -1;
100 	options->pubkey_authentication = -1;
101 	options->kerberos_authentication = -1;
102 	options->kerberos_or_local_passwd = -1;
103 	options->kerberos_ticket_cleanup = -1;
104 	options->kerberos_get_afs_token = -1;
105 	options->gss_authentication=-1;
106 	options->gss_cleanup_creds = -1;
107 	options->password_authentication = -1;
108 	options->kbd_interactive_authentication = -1;
109 	options->challenge_response_authentication = -1;
110 	options->permit_empty_passwd = -1;
111 	options->permit_user_env = -1;
112 	options->use_login = -1;
113 	options->compression = -1;
114 	options->allow_tcp_forwarding = -1;
115 	options->allow_agent_forwarding = -1;
116 	options->num_allow_users = 0;
117 	options->num_deny_users = 0;
118 	options->num_allow_groups = 0;
119 	options->num_deny_groups = 0;
120 	options->ciphers = NULL;
121 	options->macs = NULL;
122 	options->kex_algorithms = NULL;
123 	options->protocol = SSH_PROTO_UNKNOWN;
124 	options->gateway_ports = -1;
125 	options->num_subsystems = 0;
126 	options->max_startups_begin = -1;
127 	options->max_startups_rate = -1;
128 	options->max_startups = -1;
129 	options->max_authtries = -1;
130 	options->max_sessions = -1;
131 	options->banner = NULL;
132 	options->use_dns = -1;
133 	options->client_alive_interval = -1;
134 	options->client_alive_count_max = -1;
135 	options->num_authkeys_files = 0;
136 	options->num_accept_env = 0;
137 	options->permit_tun = -1;
138 	options->num_permitted_opens = -1;
139 	options->adm_forced_command = NULL;
140 	options->chroot_directory = NULL;
141 	options->zero_knowledge_password_authentication = -1;
142 	options->revoked_keys_file = NULL;
143 	options->trusted_user_ca_keys = NULL;
144 	options->authorized_principals_file = NULL;
145 	options->ip_qos_interactive = -1;
146 	options->ip_qos_bulk = -1;
147 	options->version_addendum = NULL;
148 	options->hpn_disabled = -1;
149 	options->hpn_buffer_size = -1;
150 	options->tcp_rcv_buf_poll = -1;
151 #ifdef	NONE_CIPHER_ENABLED
152 	options->none_enabled = -1;
153 #endif
154 }
155 
156 void
157 fill_default_server_options(ServerOptions *options)
158 {
159 	/* Portable-specific options */
160 	if (options->use_pam == -1)
161 		options->use_pam = 1;
162 
163 	/* Standard Options */
164 	if (options->protocol == SSH_PROTO_UNKNOWN)
165 		options->protocol = SSH_PROTO_2;
166 	if (options->num_host_key_files == 0) {
167 		/* fill default hostkeys for protocols */
168 		if (options->protocol & SSH_PROTO_1)
169 			options->host_key_files[options->num_host_key_files++] =
170 			    _PATH_HOST_KEY_FILE;
171 		if (options->protocol & SSH_PROTO_2) {
172 			options->host_key_files[options->num_host_key_files++] =
173 			    _PATH_HOST_RSA_KEY_FILE;
174 			options->host_key_files[options->num_host_key_files++] =
175 			    _PATH_HOST_DSA_KEY_FILE;
176 #ifdef OPENSSL_HAS_ECC
177 			options->host_key_files[options->num_host_key_files++] =
178 			    _PATH_HOST_ECDSA_KEY_FILE;
179 #endif
180 		}
181 	}
182 	/* No certificates by default */
183 	if (options->num_ports == 0)
184 		options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
185 	if (options->listen_addrs == NULL)
186 		add_listen_addr(options, NULL, 0);
187 	if (options->pid_file == NULL)
188 		options->pid_file = _PATH_SSH_DAEMON_PID_FILE;
189 	if (options->server_key_bits == -1)
190 		options->server_key_bits = 1024;
191 	if (options->login_grace_time == -1)
192 		options->login_grace_time = 120;
193 	if (options->key_regeneration_time == -1)
194 		options->key_regeneration_time = 3600;
195 	if (options->permit_root_login == PERMIT_NOT_SET)
196 		options->permit_root_login = PERMIT_NO;
197 	if (options->ignore_rhosts == -1)
198 		options->ignore_rhosts = 1;
199 	if (options->ignore_user_known_hosts == -1)
200 		options->ignore_user_known_hosts = 0;
201 	if (options->print_motd == -1)
202 		options->print_motd = 1;
203 	if (options->print_lastlog == -1)
204 		options->print_lastlog = 1;
205 	if (options->x11_forwarding == -1)
206 		options->x11_forwarding = 1;
207 	if (options->x11_display_offset == -1)
208 		options->x11_display_offset = 10;
209 	if (options->x11_use_localhost == -1)
210 		options->x11_use_localhost = 1;
211 	if (options->xauth_location == NULL)
212 		options->xauth_location = _PATH_XAUTH;
213 	if (options->strict_modes == -1)
214 		options->strict_modes = 1;
215 	if (options->tcp_keep_alive == -1)
216 		options->tcp_keep_alive = 1;
217 	if (options->log_facility == SYSLOG_FACILITY_NOT_SET)
218 		options->log_facility = SYSLOG_FACILITY_AUTH;
219 	if (options->log_level == SYSLOG_LEVEL_NOT_SET)
220 		options->log_level = SYSLOG_LEVEL_INFO;
221 	if (options->rhosts_rsa_authentication == -1)
222 		options->rhosts_rsa_authentication = 0;
223 	if (options->hostbased_authentication == -1)
224 		options->hostbased_authentication = 0;
225 	if (options->hostbased_uses_name_from_packet_only == -1)
226 		options->hostbased_uses_name_from_packet_only = 0;
227 	if (options->rsa_authentication == -1)
228 		options->rsa_authentication = 1;
229 	if (options->pubkey_authentication == -1)
230 		options->pubkey_authentication = 1;
231 	if (options->kerberos_authentication == -1)
232 		options->kerberos_authentication = 0;
233 	if (options->kerberos_or_local_passwd == -1)
234 		options->kerberos_or_local_passwd = 1;
235 	if (options->kerberos_ticket_cleanup == -1)
236 		options->kerberos_ticket_cleanup = 1;
237 	if (options->kerberos_get_afs_token == -1)
238 		options->kerberos_get_afs_token = 0;
239 	if (options->gss_authentication == -1)
240 		options->gss_authentication = 0;
241 	if (options->gss_cleanup_creds == -1)
242 		options->gss_cleanup_creds = 1;
243 	if (options->password_authentication == -1)
244 		options->password_authentication = 0;
245 	if (options->kbd_interactive_authentication == -1)
246 		options->kbd_interactive_authentication = 0;
247 	if (options->challenge_response_authentication == -1)
248 		options->challenge_response_authentication = 1;
249 	if (options->permit_empty_passwd == -1)
250 		options->permit_empty_passwd = 0;
251 	if (options->permit_user_env == -1)
252 		options->permit_user_env = 0;
253 	if (options->use_login == -1)
254 		options->use_login = 0;
255 	if (options->compression == -1)
256 		options->compression = COMP_DELAYED;
257 	if (options->allow_tcp_forwarding == -1)
258 		options->allow_tcp_forwarding = 1;
259 	if (options->allow_agent_forwarding == -1)
260 		options->allow_agent_forwarding = 1;
261 	if (options->gateway_ports == -1)
262 		options->gateway_ports = 0;
263 	if (options->max_startups == -1)
264 		options->max_startups = 10;
265 	if (options->max_startups_rate == -1)
266 		options->max_startups_rate = 100;		/* 100% */
267 	if (options->max_startups_begin == -1)
268 		options->max_startups_begin = options->max_startups;
269 	if (options->max_authtries == -1)
270 		options->max_authtries = DEFAULT_AUTH_FAIL_MAX;
271 	if (options->max_sessions == -1)
272 		options->max_sessions = DEFAULT_SESSIONS_MAX;
273 	if (options->use_dns == -1)
274 		options->use_dns = 1;
275 	if (options->client_alive_interval == -1)
276 		options->client_alive_interval = 0;
277 	if (options->client_alive_count_max == -1)
278 		options->client_alive_count_max = 3;
279 	if (options->num_authkeys_files == 0) {
280 		options->authorized_keys_files[options->num_authkeys_files++] =
281 		    xstrdup(_PATH_SSH_USER_PERMITTED_KEYS);
282 		options->authorized_keys_files[options->num_authkeys_files++] =
283 		    xstrdup(_PATH_SSH_USER_PERMITTED_KEYS2);
284 	}
285 	if (options->permit_tun == -1)
286 		options->permit_tun = SSH_TUNMODE_NO;
287 	if (options->zero_knowledge_password_authentication == -1)
288 		options->zero_knowledge_password_authentication = 0;
289 	if (options->ip_qos_interactive == -1)
290 		options->ip_qos_interactive = IPTOS_LOWDELAY;
291 	if (options->ip_qos_bulk == -1)
292 		options->ip_qos_bulk = IPTOS_THROUGHPUT;
293 	if (options->version_addendum == NULL)
294 		options->version_addendum = xstrdup(SSH_VERSION_FREEBSD);
295 	/* Turn privilege separation on by default */
296 	if (use_privsep == -1)
297 		use_privsep = PRIVSEP_ON;
298 
299 #ifndef HAVE_MMAP
300 	if (use_privsep && options->compression == 1) {
301 		error("This platform does not support both privilege "
302 		    "separation and compression");
303 		error("Compression disabled");
304 		options->compression = 0;
305 	}
306 #endif
307 
308 	if (options->hpn_disabled == -1)
309 		options->hpn_disabled = 0;
310 	if (options->hpn_buffer_size == -1) {
311 		/*
312 		 * HPN buffer size option not explicitly set.  Try to figure
313 		 * out what value to use or resort to default.
314 		 */
315 		options->hpn_buffer_size = CHAN_SES_WINDOW_DEFAULT;
316 		if (!options->hpn_disabled) {
317 			sock_get_rcvbuf(&options->hpn_buffer_size, 0);
318 			debug ("HPN Buffer Size: %d", options->hpn_buffer_size);
319 		}
320 	} else {
321 		/*
322 		 * In the case that the user sets both values in a
323 		 * contradictory manner hpn_disabled overrrides hpn_buffer_size.
324 		 */
325 		if (options->hpn_disabled <= 0) {
326 			u_int maxlen;
327 
328 			maxlen = buffer_get_max_len();
329 			if (options->hpn_buffer_size == 0)
330 				options->hpn_buffer_size = 1;
331 			/* Limit the maximum buffer to BUFFER_MAX_LEN. */
332 			if (options->hpn_buffer_size > maxlen / 1024)
333 				options->hpn_buffer_size = maxlen;
334 			else
335 				options->hpn_buffer_size *= 1024;
336 		} else {
337 			options->hpn_buffer_size = CHAN_TCP_WINDOW_DEFAULT;
338 		}
339 	}
340 }
341 
342 /* Keyword tokens. */
343 typedef enum {
344 	sBadOption,		/* == unknown option */
345 	/* Portable-specific options */
346 	sUsePAM,
347 	/* Standard Options */
348 	sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime,
349 	sPermitRootLogin, sLogFacility, sLogLevel,
350 	sRhostsRSAAuthentication, sRSAAuthentication,
351 	sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
352 	sKerberosGetAFSToken,
353 	sKerberosTgtPassing, sChallengeResponseAuthentication,
354 	sPasswordAuthentication, sKbdInteractiveAuthentication,
355 	sListenAddress, sAddressFamily,
356 	sPrintMotd, sPrintLastLog, sIgnoreRhosts,
357 	sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
358 	sStrictModes, sEmptyPasswd, sTCPKeepAlive,
359 	sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression,
360 	sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
361 	sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
362 	sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem,
363 	sMaxStartups, sMaxAuthTries, sMaxSessions,
364 	sBanner, sUseDNS, sHostbasedAuthentication,
365 	sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
366 	sClientAliveCountMax, sAuthorizedKeysFile,
367 	sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
368 	sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
369 	sUsePrivilegeSeparation, sAllowAgentForwarding,
370 	sZeroKnowledgePasswordAuthentication, sHostCertificate,
371 	sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
372 	sKexAlgorithms, sIPQoS, sVersionAddendum,
373 	sHPNDisabled, sHPNBufferSize, sTcpRcvBufPoll,
374 #ifdef NONE_CIPHER_ENABLED
375 	sNoneEnabled,
376 #endif
377 	sDeprecated, sUnsupported
378 } ServerOpCodes;
379 
380 #define SSHCFG_GLOBAL	0x01	/* allowed in main section of sshd_config */
381 #define SSHCFG_MATCH	0x02	/* allowed inside a Match section */
382 #define SSHCFG_ALL	(SSHCFG_GLOBAL|SSHCFG_MATCH)
383 
384 /* Textual representation of the tokens. */
385 static struct {
386 	const char *name;
387 	ServerOpCodes opcode;
388 	u_int flags;
389 } keywords[] = {
390 	/* Portable-specific options */
391 #ifdef USE_PAM
392 	{ "usepam", sUsePAM, SSHCFG_GLOBAL },
393 #else
394 	{ "usepam", sUnsupported, SSHCFG_GLOBAL },
395 #endif
396 	{ "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL },
397 	/* Standard Options */
398 	{ "port", sPort, SSHCFG_GLOBAL },
399 	{ "hostkey", sHostKeyFile, SSHCFG_GLOBAL },
400 	{ "hostdsakey", sHostKeyFile, SSHCFG_GLOBAL },		/* alias */
401 	{ "pidfile", sPidFile, SSHCFG_GLOBAL },
402 	{ "serverkeybits", sServerKeyBits, SSHCFG_GLOBAL },
403 	{ "logingracetime", sLoginGraceTime, SSHCFG_GLOBAL },
404 	{ "keyregenerationinterval", sKeyRegenerationTime, SSHCFG_GLOBAL },
405 	{ "permitrootlogin", sPermitRootLogin, SSHCFG_ALL },
406 	{ "syslogfacility", sLogFacility, SSHCFG_GLOBAL },
407 	{ "loglevel", sLogLevel, SSHCFG_GLOBAL },
408 	{ "rhostsauthentication", sDeprecated, SSHCFG_GLOBAL },
409 	{ "rhostsrsaauthentication", sRhostsRSAAuthentication, SSHCFG_ALL },
410 	{ "hostbasedauthentication", sHostbasedAuthentication, SSHCFG_ALL },
411 	{ "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly, SSHCFG_ALL },
412 	{ "rsaauthentication", sRSAAuthentication, SSHCFG_ALL },
413 	{ "pubkeyauthentication", sPubkeyAuthentication, SSHCFG_ALL },
414 	{ "dsaauthentication", sPubkeyAuthentication, SSHCFG_GLOBAL }, /* alias */
415 #ifdef KRB5
416 	{ "kerberosauthentication", sKerberosAuthentication, SSHCFG_ALL },
417 	{ "kerberosorlocalpasswd", sKerberosOrLocalPasswd, SSHCFG_GLOBAL },
418 	{ "kerberosticketcleanup", sKerberosTicketCleanup, SSHCFG_GLOBAL },
419 #ifdef USE_AFS
420 	{ "kerberosgetafstoken", sKerberosGetAFSToken, SSHCFG_GLOBAL },
421 #else
422 	{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
423 #endif
424 #else
425 	{ "kerberosauthentication", sUnsupported, SSHCFG_ALL },
426 	{ "kerberosorlocalpasswd", sUnsupported, SSHCFG_GLOBAL },
427 	{ "kerberosticketcleanup", sUnsupported, SSHCFG_GLOBAL },
428 	{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
429 #endif
430 	{ "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL },
431 	{ "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
432 #ifdef GSSAPI
433 	{ "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
434 	{ "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
435 #else
436 	{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
437 	{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
438 #endif
439 	{ "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
440 	{ "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
441 	{ "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
442 	{ "skeyauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL }, /* alias */
443 #ifdef JPAKE
444 	{ "zeroknowledgepasswordauthentication", sZeroKnowledgePasswordAuthentication, SSHCFG_ALL },
445 #else
446 	{ "zeroknowledgepasswordauthentication", sUnsupported, SSHCFG_ALL },
447 #endif
448 	{ "checkmail", sDeprecated, SSHCFG_GLOBAL },
449 	{ "listenaddress", sListenAddress, SSHCFG_GLOBAL },
450 	{ "addressfamily", sAddressFamily, SSHCFG_GLOBAL },
451 	{ "printmotd", sPrintMotd, SSHCFG_GLOBAL },
452 	{ "printlastlog", sPrintLastLog, SSHCFG_GLOBAL },
453 	{ "ignorerhosts", sIgnoreRhosts, SSHCFG_GLOBAL },
454 	{ "ignoreuserknownhosts", sIgnoreUserKnownHosts, SSHCFG_GLOBAL },
455 	{ "x11forwarding", sX11Forwarding, SSHCFG_ALL },
456 	{ "x11displayoffset", sX11DisplayOffset, SSHCFG_ALL },
457 	{ "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL },
458 	{ "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
459 	{ "strictmodes", sStrictModes, SSHCFG_GLOBAL },
460 	{ "permitemptypasswords", sEmptyPasswd, SSHCFG_ALL },
461 	{ "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL },
462 	{ "uselogin", sUseLogin, SSHCFG_GLOBAL },
463 	{ "compression", sCompression, SSHCFG_GLOBAL },
464 	{ "tcpkeepalive", sTCPKeepAlive, SSHCFG_GLOBAL },
465 	{ "keepalive", sTCPKeepAlive, SSHCFG_GLOBAL },	/* obsolete alias */
466 	{ "allowtcpforwarding", sAllowTcpForwarding, SSHCFG_ALL },
467 	{ "allowagentforwarding", sAllowAgentForwarding, SSHCFG_ALL },
468 	{ "allowusers", sAllowUsers, SSHCFG_ALL },
469 	{ "denyusers", sDenyUsers, SSHCFG_ALL },
470 	{ "allowgroups", sAllowGroups, SSHCFG_ALL },
471 	{ "denygroups", sDenyGroups, SSHCFG_ALL },
472 	{ "ciphers", sCiphers, SSHCFG_GLOBAL },
473 	{ "macs", sMacs, SSHCFG_GLOBAL },
474 	{ "protocol", sProtocol, SSHCFG_GLOBAL },
475 	{ "gatewayports", sGatewayPorts, SSHCFG_ALL },
476 	{ "subsystem", sSubsystem, SSHCFG_GLOBAL },
477 	{ "maxstartups", sMaxStartups, SSHCFG_GLOBAL },
478 	{ "maxauthtries", sMaxAuthTries, SSHCFG_ALL },
479 	{ "maxsessions", sMaxSessions, SSHCFG_ALL },
480 	{ "banner", sBanner, SSHCFG_ALL },
481 	{ "usedns", sUseDNS, SSHCFG_GLOBAL },
482 	{ "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL },
483 	{ "reversemappingcheck", sDeprecated, SSHCFG_GLOBAL },
484 	{ "clientaliveinterval", sClientAliveInterval, SSHCFG_GLOBAL },
485 	{ "clientalivecountmax", sClientAliveCountMax, SSHCFG_GLOBAL },
486 	{ "authorizedkeysfile", sAuthorizedKeysFile, SSHCFG_ALL },
487 	{ "authorizedkeysfile2", sDeprecated, SSHCFG_ALL },
488 	{ "useprivilegeseparation", sUsePrivilegeSeparation, SSHCFG_GLOBAL},
489 	{ "acceptenv", sAcceptEnv, SSHCFG_ALL },
490 	{ "permittunnel", sPermitTunnel, SSHCFG_ALL },
491 	{ "match", sMatch, SSHCFG_ALL },
492 	{ "permitopen", sPermitOpen, SSHCFG_ALL },
493 	{ "forcecommand", sForceCommand, SSHCFG_ALL },
494 	{ "chrootdirectory", sChrootDirectory, SSHCFG_ALL },
495 	{ "hostcertificate", sHostCertificate, SSHCFG_GLOBAL },
496 	{ "revokedkeys", sRevokedKeys, SSHCFG_ALL },
497 	{ "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL },
498 	{ "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL },
499 	{ "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL },
500 	{ "ipqos", sIPQoS, SSHCFG_ALL },
501 	{ "versionaddendum", sVersionAddendum, SSHCFG_GLOBAL },
502 	{ "versionaddendum", sVersionAddendum, SSHCFG_GLOBAL },
503 	{ "hpndisabled", sHPNDisabled, SSHCFG_ALL },
504 	{ "hpnbuffersize", sHPNBufferSize, SSHCFG_ALL },
505 	{ "tcprcvbufpoll", sTcpRcvBufPoll, SSHCFG_ALL },
506 #ifdef NONE_CIPHER_ENABLED
507 	{ "noneenabled", sNoneEnabled, SSHCFG_ALL },
508 #endif
509 	{ NULL, sBadOption, 0 }
510 };
511 
512 static struct {
513 	int val;
514 	char *text;
515 } tunmode_desc[] = {
516 	{ SSH_TUNMODE_NO, "no" },
517 	{ SSH_TUNMODE_POINTOPOINT, "point-to-point" },
518 	{ SSH_TUNMODE_ETHERNET, "ethernet" },
519 	{ SSH_TUNMODE_YES, "yes" },
520 	{ -1, NULL }
521 };
522 
523 /*
524  * Returns the number of the token pointed to by cp or sBadOption.
525  */
526 
527 static ServerOpCodes
528 parse_token(const char *cp, const char *filename,
529 	    int linenum, u_int *flags)
530 {
531 	u_int i;
532 
533 	for (i = 0; keywords[i].name; i++)
534 		if (strcasecmp(cp, keywords[i].name) == 0) {
535 			*flags = keywords[i].flags;
536 			return keywords[i].opcode;
537 		}
538 
539 	error("%s: line %d: Bad configuration option: %s",
540 	    filename, linenum, cp);
541 	return sBadOption;
542 }
543 
544 char *
545 derelativise_path(const char *path)
546 {
547 	char *expanded, *ret, cwd[MAXPATHLEN];
548 
549 	expanded = tilde_expand_filename(path, getuid());
550 	if (*expanded == '/')
551 		return expanded;
552 	if (getcwd(cwd, sizeof(cwd)) == NULL)
553 		fatal("%s: getcwd: %s", __func__, strerror(errno));
554 	xasprintf(&ret, "%s/%s", cwd, expanded);
555 	xfree(expanded);
556 	return ret;
557 }
558 
559 static void
560 add_listen_addr(ServerOptions *options, char *addr, int port)
561 {
562 	u_int i;
563 
564 	if (options->num_ports == 0)
565 		options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
566 	if (options->address_family == -1)
567 		options->address_family = AF_UNSPEC;
568 	if (port == 0)
569 		for (i = 0; i < options->num_ports; i++)
570 			add_one_listen_addr(options, addr, options->ports[i]);
571 	else
572 		add_one_listen_addr(options, addr, port);
573 }
574 
575 static void
576 add_one_listen_addr(ServerOptions *options, char *addr, int port)
577 {
578 	struct addrinfo hints, *ai, *aitop;
579 	char strport[NI_MAXSERV];
580 	int gaierr;
581 
582 	memset(&hints, 0, sizeof(hints));
583 	hints.ai_family = options->address_family;
584 	hints.ai_socktype = SOCK_STREAM;
585 	hints.ai_flags = (addr == NULL) ? AI_PASSIVE : 0;
586 	snprintf(strport, sizeof strport, "%d", port);
587 	if ((gaierr = getaddrinfo(addr, strport, &hints, &aitop)) != 0)
588 		fatal("bad addr or host: %s (%s)",
589 		    addr ? addr : "<NULL>",
590 		    ssh_gai_strerror(gaierr));
591 	for (ai = aitop; ai->ai_next; ai = ai->ai_next)
592 		;
593 	ai->ai_next = options->listen_addrs;
594 	options->listen_addrs = aitop;
595 }
596 
597 struct connection_info *
598 get_connection_info(int populate, int use_dns)
599 {
600 	static struct connection_info ci;
601 
602 	if (!populate)
603 		return &ci;
604 	ci.host = get_canonical_hostname(use_dns);
605 	ci.address = get_remote_ipaddr();
606 	ci.laddress = get_local_ipaddr(packet_get_connection_in());
607 	ci.lport = get_local_port();
608 	return &ci;
609 }
610 
611 /*
612  * The strategy for the Match blocks is that the config file is parsed twice.
613  *
614  * The first time is at startup.  activep is initialized to 1 and the
615  * directives in the global context are processed and acted on.  Hitting a
616  * Match directive unsets activep and the directives inside the block are
617  * checked for syntax only.
618  *
619  * The second time is after a connection has been established but before
620  * authentication.  activep is initialized to 2 and global config directives
621  * are ignored since they have already been processed.  If the criteria in a
622  * Match block is met, activep is set and the subsequent directives
623  * processed and actioned until EOF or another Match block unsets it.  Any
624  * options set are copied into the main server config.
625  *
626  * Potential additions/improvements:
627  *  - Add Match support for pre-kex directives, eg Protocol, Ciphers.
628  *
629  *  - Add a Tag directive (idea from David Leonard) ala pf, eg:
630  *	Match Address 192.168.0.*
631  *		Tag trusted
632  *	Match Group wheel
633  *		Tag trusted
634  *	Match Tag trusted
635  *		AllowTcpForwarding yes
636  *		GatewayPorts clientspecified
637  *		[...]
638  *
639  *  - Add a PermittedChannelRequests directive
640  *	Match Group shell
641  *		PermittedChannelRequests session,forwarded-tcpip
642  */
643 
644 static int
645 match_cfg_line_group(const char *grps, int line, const char *user)
646 {
647 	int result = 0;
648 	struct passwd *pw;
649 
650 	if (user == NULL)
651 		goto out;
652 
653 	if ((pw = getpwnam(user)) == NULL) {
654 		debug("Can't match group at line %d because user %.100s does "
655 		    "not exist", line, user);
656 	} else if (ga_init(pw->pw_name, pw->pw_gid) == 0) {
657 		debug("Can't Match group because user %.100s not in any group "
658 		    "at line %d", user, line);
659 	} else if (ga_match_pattern_list(grps) != 1) {
660 		debug("user %.100s does not match group list %.100s at line %d",
661 		    user, grps, line);
662 	} else {
663 		debug("user %.100s matched group list %.100s at line %d", user,
664 		    grps, line);
665 		result = 1;
666 	}
667 out:
668 	ga_free();
669 	return result;
670 }
671 
672 /*
673  * All of the attributes on a single Match line are ANDed together, so we need to check every
674  * attribute and set the result to zero if any attribute does not match.
675  */
676 static int
677 match_cfg_line(char **condition, int line, struct connection_info *ci)
678 {
679 	int result = 1, port;
680 	char *arg, *attrib, *cp = *condition;
681 	size_t len;
682 
683 	if (ci == NULL)
684 		debug3("checking syntax for 'Match %s'", cp);
685 	else
686 		debug3("checking match for '%s' user %s host %s addr %s "
687 		    "laddr %s lport %d", cp, ci->user ? ci->user : "(null)",
688 		    ci->host ? ci->host : "(null)",
689 		    ci->address ? ci->address : "(null)",
690 		    ci->laddress ? ci->laddress : "(null)", ci->lport);
691 
692 	while ((attrib = strdelim(&cp)) && *attrib != '\0') {
693 		if ((arg = strdelim(&cp)) == NULL || *arg == '\0') {
694 			error("Missing Match criteria for %s", attrib);
695 			return -1;
696 		}
697 		len = strlen(arg);
698 		if (strcasecmp(attrib, "user") == 0) {
699 			if (ci == NULL || ci->user == NULL) {
700 				result = 0;
701 				continue;
702 			}
703 			if (match_pattern_list(ci->user, arg, len, 0) != 1)
704 				result = 0;
705 			else
706 				debug("user %.100s matched 'User %.100s' at "
707 				    "line %d", ci->user, arg, line);
708 		} else if (strcasecmp(attrib, "group") == 0) {
709 			if (ci == NULL || ci->user == NULL) {
710 				result = 0;
711 				continue;
712 			}
713 			switch (match_cfg_line_group(arg, line, ci->user)) {
714 			case -1:
715 				return -1;
716 			case 0:
717 				result = 0;
718 			}
719 		} else if (strcasecmp(attrib, "host") == 0) {
720 			if (ci == NULL || ci->host == NULL) {
721 				result = 0;
722 				continue;
723 			}
724 			if (match_hostname(ci->host, arg, len) != 1)
725 				result = 0;
726 			else
727 				debug("connection from %.100s matched 'Host "
728 				    "%.100s' at line %d", ci->host, arg, line);
729 		} else if (strcasecmp(attrib, "address") == 0) {
730 			if (ci == NULL || ci->address == NULL) {
731 				result = 0;
732 				continue;
733 			}
734 			switch (addr_match_list(ci->address, arg)) {
735 			case 1:
736 				debug("connection from %.100s matched 'Address "
737 				    "%.100s' at line %d", ci->address, arg, line);
738 				break;
739 			case 0:
740 			case -1:
741 				result = 0;
742 				break;
743 			case -2:
744 				return -1;
745 			}
746 		} else if (strcasecmp(attrib, "localaddress") == 0){
747 			if (ci == NULL || ci->laddress == NULL) {
748 				result = 0;
749 				continue;
750 			}
751 			switch (addr_match_list(ci->laddress, arg)) {
752 			case 1:
753 				debug("connection from %.100s matched "
754 				    "'LocalAddress %.100s' at line %d",
755 				    ci->laddress, arg, line);
756 				break;
757 			case 0:
758 			case -1:
759 				result = 0;
760 				break;
761 			case -2:
762 				return -1;
763 			}
764 		} else if (strcasecmp(attrib, "localport") == 0) {
765 			if ((port = a2port(arg)) == -1) {
766 				error("Invalid LocalPort '%s' on Match line",
767 				    arg);
768 				return -1;
769 			}
770 			if (ci == NULL || ci->lport == 0) {
771 				result = 0;
772 				continue;
773 			}
774 			/* TODO support port lists */
775 			if (port == ci->lport)
776 				debug("connection from %.100s matched "
777 				    "'LocalPort %d' at line %d",
778 				    ci->laddress, port, line);
779 			else
780 				result = 0;
781 		} else {
782 			error("Unsupported Match attribute %s", attrib);
783 			return -1;
784 		}
785 	}
786 	if (ci != NULL)
787 		debug3("match %sfound", result ? "" : "not ");
788 	*condition = cp;
789 	return result;
790 }
791 
792 #define WHITESPACE " \t\r\n"
793 
794 /* Multistate option parsing */
795 struct multistate {
796 	char *key;
797 	int value;
798 };
799 static const struct multistate multistate_addressfamily[] = {
800 	{ "inet",			AF_INET },
801 	{ "inet6",			AF_INET6 },
802 	{ "any",			AF_UNSPEC },
803 	{ NULL, -1 }
804 };
805 static const struct multistate multistate_permitrootlogin[] = {
806 	{ "without-password",		PERMIT_NO_PASSWD },
807 	{ "forced-commands-only",	PERMIT_FORCED_ONLY },
808 	{ "yes",			PERMIT_YES },
809 	{ "no",				PERMIT_NO },
810 	{ NULL, -1 }
811 };
812 static const struct multistate multistate_compression[] = {
813 	{ "delayed",			COMP_DELAYED },
814 	{ "yes",			COMP_ZLIB },
815 	{ "no",				COMP_NONE },
816 	{ NULL, -1 }
817 };
818 static const struct multistate multistate_gatewayports[] = {
819 	{ "clientspecified",		2 },
820 	{ "yes",			1 },
821 	{ "no",				0 },
822 	{ NULL, -1 }
823 };
824 static const struct multistate multistate_privsep[] = {
825 	{ "yes",			PRIVSEP_NOSANDBOX },
826 	{ "sandbox",			PRIVSEP_ON },
827 	{ "nosandbox",			PRIVSEP_NOSANDBOX },
828 	{ "no",				PRIVSEP_OFF },
829 	{ NULL, -1 }
830 };
831 
832 int
833 process_server_config_line(ServerOptions *options, char *line,
834     const char *filename, int linenum, int *activep,
835     struct connection_info *connectinfo)
836 {
837 	char *cp, **charptr, *arg, *p;
838 	int cmdline = 0, *intptr, value, value2, n;
839 	SyslogFacility *log_facility_ptr;
840 	LogLevel *log_level_ptr;
841 	ServerOpCodes opcode;
842 	int port;
843 	u_int i, flags = 0;
844 	size_t len;
845 	const struct multistate *multistate_ptr;
846 
847 	cp = line;
848 	if ((arg = strdelim(&cp)) == NULL)
849 		return 0;
850 	/* Ignore leading whitespace */
851 	if (*arg == '\0')
852 		arg = strdelim(&cp);
853 	if (!arg || !*arg || *arg == '#')
854 		return 0;
855 	intptr = NULL;
856 	charptr = NULL;
857 	opcode = parse_token(arg, filename, linenum, &flags);
858 
859 	if (activep == NULL) { /* We are processing a command line directive */
860 		cmdline = 1;
861 		activep = &cmdline;
862 	}
863 	if (*activep && opcode != sMatch)
864 		debug3("%s:%d setting %s %s", filename, linenum, arg, cp);
865 	if (*activep == 0 && !(flags & SSHCFG_MATCH)) {
866 		if (connectinfo == NULL) {
867 			fatal("%s line %d: Directive '%s' is not allowed "
868 			    "within a Match block", filename, linenum, arg);
869 		} else { /* this is a directive we have already processed */
870 			while (arg)
871 				arg = strdelim(&cp);
872 			return 0;
873 		}
874 	}
875 
876 	switch (opcode) {
877 	/* Portable-specific options */
878 	case sUsePAM:
879 		intptr = &options->use_pam;
880 		goto parse_flag;
881 
882 	/* Standard Options */
883 	case sBadOption:
884 		return -1;
885 	case sPort:
886 		/* ignore ports from configfile if cmdline specifies ports */
887 		if (options->ports_from_cmdline)
888 			return 0;
889 		if (options->listen_addrs != NULL)
890 			fatal("%s line %d: ports must be specified before "
891 			    "ListenAddress.", filename, linenum);
892 		if (options->num_ports >= MAX_PORTS)
893 			fatal("%s line %d: too many ports.",
894 			    filename, linenum);
895 		arg = strdelim(&cp);
896 		if (!arg || *arg == '\0')
897 			fatal("%s line %d: missing port number.",
898 			    filename, linenum);
899 		options->ports[options->num_ports++] = a2port(arg);
900 		if (options->ports[options->num_ports-1] <= 0)
901 			fatal("%s line %d: Badly formatted port number.",
902 			    filename, linenum);
903 		break;
904 
905 	case sServerKeyBits:
906 		intptr = &options->server_key_bits;
907  parse_int:
908 		arg = strdelim(&cp);
909 		if (!arg || *arg == '\0')
910 			fatal("%s line %d: missing integer value.",
911 			    filename, linenum);
912 		value = atoi(arg);
913 		if (*activep && *intptr == -1)
914 			*intptr = value;
915 		break;
916 
917 	case sLoginGraceTime:
918 		intptr = &options->login_grace_time;
919  parse_time:
920 		arg = strdelim(&cp);
921 		if (!arg || *arg == '\0')
922 			fatal("%s line %d: missing time value.",
923 			    filename, linenum);
924 		if ((value = convtime(arg)) == -1)
925 			fatal("%s line %d: invalid time value.",
926 			    filename, linenum);
927 		if (*intptr == -1)
928 			*intptr = value;
929 		break;
930 
931 	case sKeyRegenerationTime:
932 		intptr = &options->key_regeneration_time;
933 		goto parse_time;
934 
935 	case sListenAddress:
936 		arg = strdelim(&cp);
937 		if (arg == NULL || *arg == '\0')
938 			fatal("%s line %d: missing address",
939 			    filename, linenum);
940 		/* check for bare IPv6 address: no "[]" and 2 or more ":" */
941 		if (strchr(arg, '[') == NULL && (p = strchr(arg, ':')) != NULL
942 		    && strchr(p+1, ':') != NULL) {
943 			add_listen_addr(options, arg, 0);
944 			break;
945 		}
946 		p = hpdelim(&arg);
947 		if (p == NULL)
948 			fatal("%s line %d: bad address:port usage",
949 			    filename, linenum);
950 		p = cleanhostname(p);
951 		if (arg == NULL)
952 			port = 0;
953 		else if ((port = a2port(arg)) <= 0)
954 			fatal("%s line %d: bad port number", filename, linenum);
955 
956 		add_listen_addr(options, p, port);
957 
958 		break;
959 
960 	case sAddressFamily:
961 		intptr = &options->address_family;
962 		multistate_ptr = multistate_addressfamily;
963 		if (options->listen_addrs != NULL)
964 			fatal("%s line %d: address family must be specified "
965 			    "before ListenAddress.", filename, linenum);
966  parse_multistate:
967 		arg = strdelim(&cp);
968 		if (!arg || *arg == '\0')
969 			fatal("%s line %d: missing argument.",
970 			    filename, linenum);
971 		value = -1;
972 		for (i = 0; multistate_ptr[i].key != NULL; i++) {
973 			if (strcasecmp(arg, multistate_ptr[i].key) == 0) {
974 				value = multistate_ptr[i].value;
975 				break;
976 			}
977 		}
978 		if (value == -1)
979 			fatal("%s line %d: unsupported option \"%s\".",
980 			    filename, linenum, arg);
981 		if (*activep && *intptr == -1)
982 			*intptr = value;
983 		break;
984 
985 	case sHostKeyFile:
986 		intptr = &options->num_host_key_files;
987 		if (*intptr >= MAX_HOSTKEYS)
988 			fatal("%s line %d: too many host keys specified (max %d).",
989 			    filename, linenum, MAX_HOSTKEYS);
990 		charptr = &options->host_key_files[*intptr];
991  parse_filename:
992 		arg = strdelim(&cp);
993 		if (!arg || *arg == '\0')
994 			fatal("%s line %d: missing file name.",
995 			    filename, linenum);
996 		if (*activep && *charptr == NULL) {
997 			*charptr = derelativise_path(arg);
998 			/* increase optional counter */
999 			if (intptr != NULL)
1000 				*intptr = *intptr + 1;
1001 		}
1002 		break;
1003 
1004 	case sHostCertificate:
1005 		intptr = &options->num_host_cert_files;
1006 		if (*intptr >= MAX_HOSTKEYS)
1007 			fatal("%s line %d: too many host certificates "
1008 			    "specified (max %d).", filename, linenum,
1009 			    MAX_HOSTCERTS);
1010 		charptr = &options->host_cert_files[*intptr];
1011 		goto parse_filename;
1012 		break;
1013 
1014 	case sPidFile:
1015 		charptr = &options->pid_file;
1016 		goto parse_filename;
1017 
1018 	case sPermitRootLogin:
1019 		intptr = &options->permit_root_login;
1020 		multistate_ptr = multistate_permitrootlogin;
1021 		goto parse_multistate;
1022 
1023 	case sIgnoreRhosts:
1024 		intptr = &options->ignore_rhosts;
1025  parse_flag:
1026 		arg = strdelim(&cp);
1027 		if (!arg || *arg == '\0')
1028 			fatal("%s line %d: missing yes/no argument.",
1029 			    filename, linenum);
1030 		value = 0;	/* silence compiler */
1031 		if (strcmp(arg, "yes") == 0)
1032 			value = 1;
1033 		else if (strcmp(arg, "no") == 0)
1034 			value = 0;
1035 		else
1036 			fatal("%s line %d: Bad yes/no argument: %s",
1037 				filename, linenum, arg);
1038 		if (*activep && *intptr == -1)
1039 			*intptr = value;
1040 		break;
1041 
1042 	case sIgnoreUserKnownHosts:
1043 		intptr = &options->ignore_user_known_hosts;
1044 		goto parse_flag;
1045 
1046 	case sRhostsRSAAuthentication:
1047 		intptr = &options->rhosts_rsa_authentication;
1048 		goto parse_flag;
1049 
1050 	case sHostbasedAuthentication:
1051 		intptr = &options->hostbased_authentication;
1052 		goto parse_flag;
1053 
1054 	case sHostbasedUsesNameFromPacketOnly:
1055 		intptr = &options->hostbased_uses_name_from_packet_only;
1056 		goto parse_flag;
1057 
1058 	case sRSAAuthentication:
1059 		intptr = &options->rsa_authentication;
1060 		goto parse_flag;
1061 
1062 	case sPubkeyAuthentication:
1063 		intptr = &options->pubkey_authentication;
1064 		goto parse_flag;
1065 
1066 	case sKerberosAuthentication:
1067 		intptr = &options->kerberos_authentication;
1068 		goto parse_flag;
1069 
1070 	case sKerberosOrLocalPasswd:
1071 		intptr = &options->kerberos_or_local_passwd;
1072 		goto parse_flag;
1073 
1074 	case sKerberosTicketCleanup:
1075 		intptr = &options->kerberos_ticket_cleanup;
1076 		goto parse_flag;
1077 
1078 	case sKerberosGetAFSToken:
1079 		intptr = &options->kerberos_get_afs_token;
1080 		goto parse_flag;
1081 
1082 	case sGssAuthentication:
1083 		intptr = &options->gss_authentication;
1084 		goto parse_flag;
1085 
1086 	case sGssCleanupCreds:
1087 		intptr = &options->gss_cleanup_creds;
1088 		goto parse_flag;
1089 
1090 	case sPasswordAuthentication:
1091 		intptr = &options->password_authentication;
1092 		goto parse_flag;
1093 
1094 	case sZeroKnowledgePasswordAuthentication:
1095 		intptr = &options->zero_knowledge_password_authentication;
1096 		goto parse_flag;
1097 
1098 	case sKbdInteractiveAuthentication:
1099 		intptr = &options->kbd_interactive_authentication;
1100 		goto parse_flag;
1101 
1102 	case sChallengeResponseAuthentication:
1103 		intptr = &options->challenge_response_authentication;
1104 		goto parse_flag;
1105 
1106 	case sPrintMotd:
1107 		intptr = &options->print_motd;
1108 		goto parse_flag;
1109 
1110 	case sPrintLastLog:
1111 		intptr = &options->print_lastlog;
1112 		goto parse_flag;
1113 
1114 	case sX11Forwarding:
1115 		intptr = &options->x11_forwarding;
1116 		goto parse_flag;
1117 
1118 	case sX11DisplayOffset:
1119 		intptr = &options->x11_display_offset;
1120 		goto parse_int;
1121 
1122 	case sX11UseLocalhost:
1123 		intptr = &options->x11_use_localhost;
1124 		goto parse_flag;
1125 
1126 	case sXAuthLocation:
1127 		charptr = &options->xauth_location;
1128 		goto parse_filename;
1129 
1130 	case sStrictModes:
1131 		intptr = &options->strict_modes;
1132 		goto parse_flag;
1133 
1134 	case sTCPKeepAlive:
1135 		intptr = &options->tcp_keep_alive;
1136 		goto parse_flag;
1137 
1138 	case sEmptyPasswd:
1139 		intptr = &options->permit_empty_passwd;
1140 		goto parse_flag;
1141 
1142 	case sPermitUserEnvironment:
1143 		intptr = &options->permit_user_env;
1144 		goto parse_flag;
1145 
1146 	case sUseLogin:
1147 		intptr = &options->use_login;
1148 		goto parse_flag;
1149 
1150 	case sCompression:
1151 		intptr = &options->compression;
1152 		multistate_ptr = multistate_compression;
1153 		goto parse_multistate;
1154 
1155 	case sGatewayPorts:
1156 		intptr = &options->gateway_ports;
1157 		multistate_ptr = multistate_gatewayports;
1158 		goto parse_multistate;
1159 
1160 	case sUseDNS:
1161 		intptr = &options->use_dns;
1162 		goto parse_flag;
1163 
1164 	case sLogFacility:
1165 		log_facility_ptr = &options->log_facility;
1166 		arg = strdelim(&cp);
1167 		value = log_facility_number(arg);
1168 		if (value == SYSLOG_FACILITY_NOT_SET)
1169 			fatal("%.200s line %d: unsupported log facility '%s'",
1170 			    filename, linenum, arg ? arg : "<NONE>");
1171 		if (*log_facility_ptr == -1)
1172 			*log_facility_ptr = (SyslogFacility) value;
1173 		break;
1174 
1175 	case sLogLevel:
1176 		log_level_ptr = &options->log_level;
1177 		arg = strdelim(&cp);
1178 		value = log_level_number(arg);
1179 		if (value == SYSLOG_LEVEL_NOT_SET)
1180 			fatal("%.200s line %d: unsupported log level '%s'",
1181 			    filename, linenum, arg ? arg : "<NONE>");
1182 		if (*log_level_ptr == -1)
1183 			*log_level_ptr = (LogLevel) value;
1184 		break;
1185 
1186 	case sAllowTcpForwarding:
1187 		intptr = &options->allow_tcp_forwarding;
1188 		goto parse_flag;
1189 
1190 	case sAllowAgentForwarding:
1191 		intptr = &options->allow_agent_forwarding;
1192 		goto parse_flag;
1193 
1194 	case sUsePrivilegeSeparation:
1195 		intptr = &use_privsep;
1196 		multistate_ptr = multistate_privsep;
1197 		goto parse_multistate;
1198 
1199 	case sAllowUsers:
1200 		while ((arg = strdelim(&cp)) && *arg != '\0') {
1201 			if (options->num_allow_users >= MAX_ALLOW_USERS)
1202 				fatal("%s line %d: too many allow users.",
1203 				    filename, linenum);
1204 			if (!*activep)
1205 				continue;
1206 			options->allow_users[options->num_allow_users++] =
1207 			    xstrdup(arg);
1208 		}
1209 		break;
1210 
1211 	case sDenyUsers:
1212 		while ((arg = strdelim(&cp)) && *arg != '\0') {
1213 			if (options->num_deny_users >= MAX_DENY_USERS)
1214 				fatal("%s line %d: too many deny users.",
1215 				    filename, linenum);
1216 			if (!*activep)
1217 				continue;
1218 			options->deny_users[options->num_deny_users++] =
1219 			    xstrdup(arg);
1220 		}
1221 		break;
1222 
1223 	case sAllowGroups:
1224 		while ((arg = strdelim(&cp)) && *arg != '\0') {
1225 			if (options->num_allow_groups >= MAX_ALLOW_GROUPS)
1226 				fatal("%s line %d: too many allow groups.",
1227 				    filename, linenum);
1228 			if (!*activep)
1229 				continue;
1230 			options->allow_groups[options->num_allow_groups++] =
1231 			    xstrdup(arg);
1232 		}
1233 		break;
1234 
1235 	case sDenyGroups:
1236 		while ((arg = strdelim(&cp)) && *arg != '\0') {
1237 			if (options->num_deny_groups >= MAX_DENY_GROUPS)
1238 				fatal("%s line %d: too many deny groups.",
1239 				    filename, linenum);
1240 			if (!*activep)
1241 				continue;
1242 			options->deny_groups[options->num_deny_groups++] =
1243 			    xstrdup(arg);
1244 		}
1245 		break;
1246 
1247 	case sCiphers:
1248 		arg = strdelim(&cp);
1249 		if (!arg || *arg == '\0')
1250 			fatal("%s line %d: Missing argument.", filename, linenum);
1251 		if (!ciphers_valid(arg))
1252 			fatal("%s line %d: Bad SSH2 cipher spec '%s'.",
1253 			    filename, linenum, arg ? arg : "<NONE>");
1254 		if (options->ciphers == NULL)
1255 			options->ciphers = xstrdup(arg);
1256 		break;
1257 
1258 	case sMacs:
1259 		arg = strdelim(&cp);
1260 		if (!arg || *arg == '\0')
1261 			fatal("%s line %d: Missing argument.", filename, linenum);
1262 		if (!mac_valid(arg))
1263 			fatal("%s line %d: Bad SSH2 mac spec '%s'.",
1264 			    filename, linenum, arg ? arg : "<NONE>");
1265 		if (options->macs == NULL)
1266 			options->macs = xstrdup(arg);
1267 		break;
1268 
1269 	case sKexAlgorithms:
1270 		arg = strdelim(&cp);
1271 		if (!arg || *arg == '\0')
1272 			fatal("%s line %d: Missing argument.",
1273 			    filename, linenum);
1274 		if (!kex_names_valid(arg))
1275 			fatal("%s line %d: Bad SSH2 KexAlgorithms '%s'.",
1276 			    filename, linenum, arg ? arg : "<NONE>");
1277 		if (options->kex_algorithms == NULL)
1278 			options->kex_algorithms = xstrdup(arg);
1279 		break;
1280 
1281 	case sProtocol:
1282 		intptr = &options->protocol;
1283 		arg = strdelim(&cp);
1284 		if (!arg || *arg == '\0')
1285 			fatal("%s line %d: Missing argument.", filename, linenum);
1286 		value = proto_spec(arg);
1287 		if (value == SSH_PROTO_UNKNOWN)
1288 			fatal("%s line %d: Bad protocol spec '%s'.",
1289 			    filename, linenum, arg ? arg : "<NONE>");
1290 		if (*intptr == SSH_PROTO_UNKNOWN)
1291 			*intptr = value;
1292 		break;
1293 
1294 	case sSubsystem:
1295 		if (options->num_subsystems >= MAX_SUBSYSTEMS) {
1296 			fatal("%s line %d: too many subsystems defined.",
1297 			    filename, linenum);
1298 		}
1299 		arg = strdelim(&cp);
1300 		if (!arg || *arg == '\0')
1301 			fatal("%s line %d: Missing subsystem name.",
1302 			    filename, linenum);
1303 		if (!*activep) {
1304 			arg = strdelim(&cp);
1305 			break;
1306 		}
1307 		for (i = 0; i < options->num_subsystems; i++)
1308 			if (strcmp(arg, options->subsystem_name[i]) == 0)
1309 				fatal("%s line %d: Subsystem '%s' already defined.",
1310 				    filename, linenum, arg);
1311 		options->subsystem_name[options->num_subsystems] = xstrdup(arg);
1312 		arg = strdelim(&cp);
1313 		if (!arg || *arg == '\0')
1314 			fatal("%s line %d: Missing subsystem command.",
1315 			    filename, linenum);
1316 		options->subsystem_command[options->num_subsystems] = xstrdup(arg);
1317 
1318 		/* Collect arguments (separate to executable) */
1319 		p = xstrdup(arg);
1320 		len = strlen(p) + 1;
1321 		while ((arg = strdelim(&cp)) != NULL && *arg != '\0') {
1322 			len += 1 + strlen(arg);
1323 			p = xrealloc(p, 1, len);
1324 			strlcat(p, " ", len);
1325 			strlcat(p, arg, len);
1326 		}
1327 		options->subsystem_args[options->num_subsystems] = p;
1328 		options->num_subsystems++;
1329 		break;
1330 
1331 	case sMaxStartups:
1332 		arg = strdelim(&cp);
1333 		if (!arg || *arg == '\0')
1334 			fatal("%s line %d: Missing MaxStartups spec.",
1335 			    filename, linenum);
1336 		if ((n = sscanf(arg, "%d:%d:%d",
1337 		    &options->max_startups_begin,
1338 		    &options->max_startups_rate,
1339 		    &options->max_startups)) == 3) {
1340 			if (options->max_startups_begin >
1341 			    options->max_startups ||
1342 			    options->max_startups_rate > 100 ||
1343 			    options->max_startups_rate < 1)
1344 				fatal("%s line %d: Illegal MaxStartups spec.",
1345 				    filename, linenum);
1346 		} else if (n != 1)
1347 			fatal("%s line %d: Illegal MaxStartups spec.",
1348 			    filename, linenum);
1349 		else
1350 			options->max_startups = options->max_startups_begin;
1351 		break;
1352 
1353 	case sMaxAuthTries:
1354 		intptr = &options->max_authtries;
1355 		goto parse_int;
1356 
1357 	case sMaxSessions:
1358 		intptr = &options->max_sessions;
1359 		goto parse_int;
1360 
1361 	case sBanner:
1362 		charptr = &options->banner;
1363 		goto parse_filename;
1364 
1365 	/*
1366 	 * These options can contain %X options expanded at
1367 	 * connect time, so that you can specify paths like:
1368 	 *
1369 	 * AuthorizedKeysFile	/etc/ssh_keys/%u
1370 	 */
1371 	case sAuthorizedKeysFile:
1372 		if (*activep && options->num_authkeys_files == 0) {
1373 			while ((arg = strdelim(&cp)) && *arg != '\0') {
1374 				if (options->num_authkeys_files >=
1375 				    MAX_AUTHKEYS_FILES)
1376 					fatal("%s line %d: "
1377 					    "too many authorized keys files.",
1378 					    filename, linenum);
1379 				options->authorized_keys_files[
1380 				    options->num_authkeys_files++] =
1381 				    tilde_expand_filename(arg, getuid());
1382 			}
1383 		}
1384 		return 0;
1385 
1386 	case sAuthorizedPrincipalsFile:
1387 		charptr = &options->authorized_principals_file;
1388 		arg = strdelim(&cp);
1389 		if (!arg || *arg == '\0')
1390 			fatal("%s line %d: missing file name.",
1391 			    filename, linenum);
1392 		if (*activep && *charptr == NULL) {
1393 			*charptr = tilde_expand_filename(arg, getuid());
1394 			/* increase optional counter */
1395 			if (intptr != NULL)
1396 				*intptr = *intptr + 1;
1397 		}
1398 		break;
1399 
1400 	case sClientAliveInterval:
1401 		intptr = &options->client_alive_interval;
1402 		goto parse_time;
1403 
1404 	case sClientAliveCountMax:
1405 		intptr = &options->client_alive_count_max;
1406 		goto parse_int;
1407 
1408 	case sAcceptEnv:
1409 		while ((arg = strdelim(&cp)) && *arg != '\0') {
1410 			if (strchr(arg, '=') != NULL)
1411 				fatal("%s line %d: Invalid environment name.",
1412 				    filename, linenum);
1413 			if (options->num_accept_env >= MAX_ACCEPT_ENV)
1414 				fatal("%s line %d: too many allow env.",
1415 				    filename, linenum);
1416 			if (!*activep)
1417 				continue;
1418 			options->accept_env[options->num_accept_env++] =
1419 			    xstrdup(arg);
1420 		}
1421 		break;
1422 
1423 	case sPermitTunnel:
1424 		intptr = &options->permit_tun;
1425 		arg = strdelim(&cp);
1426 		if (!arg || *arg == '\0')
1427 			fatal("%s line %d: Missing yes/point-to-point/"
1428 			    "ethernet/no argument.", filename, linenum);
1429 		value = -1;
1430 		for (i = 0; tunmode_desc[i].val != -1; i++)
1431 			if (strcmp(tunmode_desc[i].text, arg) == 0) {
1432 				value = tunmode_desc[i].val;
1433 				break;
1434 			}
1435 		if (value == -1)
1436 			fatal("%s line %d: Bad yes/point-to-point/ethernet/"
1437 			    "no argument: %s", filename, linenum, arg);
1438 		if (*intptr == -1)
1439 			*intptr = value;
1440 		break;
1441 
1442 	case sMatch:
1443 		if (cmdline)
1444 			fatal("Match directive not supported as a command-line "
1445 			   "option");
1446 		value = match_cfg_line(&cp, linenum, connectinfo);
1447 		if (value < 0)
1448 			fatal("%s line %d: Bad Match condition", filename,
1449 			    linenum);
1450 		*activep = value;
1451 		break;
1452 
1453 	case sPermitOpen:
1454 		arg = strdelim(&cp);
1455 		if (!arg || *arg == '\0')
1456 			fatal("%s line %d: missing PermitOpen specification",
1457 			    filename, linenum);
1458 		n = options->num_permitted_opens;	/* modified later */
1459 		if (strcmp(arg, "any") == 0) {
1460 			if (*activep && n == -1) {
1461 				channel_clear_adm_permitted_opens();
1462 				options->num_permitted_opens = 0;
1463 			}
1464 			break;
1465 		}
1466 		if (strcmp(arg, "none") == 0) {
1467 			if (*activep && n == -1) {
1468 				channel_clear_adm_permitted_opens();
1469 				options->num_permitted_opens = 1;
1470 				channel_disable_adm_local_opens();
1471 			}
1472 			break;
1473 		}
1474 		if (*activep && n == -1)
1475 			channel_clear_adm_permitted_opens();
1476 		for (; arg != NULL && *arg != '\0'; arg = strdelim(&cp)) {
1477 			p = hpdelim(&arg);
1478 			if (p == NULL)
1479 				fatal("%s line %d: missing host in PermitOpen",
1480 				    filename, linenum);
1481 			p = cleanhostname(p);
1482 			if (arg == NULL || ((port = permitopen_port(arg)) < 0))
1483 				fatal("%s line %d: bad port number in "
1484 				    "PermitOpen", filename, linenum);
1485 			if (*activep && n == -1)
1486 				options->num_permitted_opens =
1487 				    channel_add_adm_permitted_opens(p, port);
1488 		}
1489 		break;
1490 
1491 	case sForceCommand:
1492 		if (cp == NULL)
1493 			fatal("%.200s line %d: Missing argument.", filename,
1494 			    linenum);
1495 		len = strspn(cp, WHITESPACE);
1496 		if (*activep && options->adm_forced_command == NULL)
1497 			options->adm_forced_command = xstrdup(cp + len);
1498 		return 0;
1499 
1500 	case sChrootDirectory:
1501 		charptr = &options->chroot_directory;
1502 
1503 		arg = strdelim(&cp);
1504 		if (!arg || *arg == '\0')
1505 			fatal("%s line %d: missing file name.",
1506 			    filename, linenum);
1507 		if (*activep && *charptr == NULL)
1508 			*charptr = xstrdup(arg);
1509 		break;
1510 
1511 	case sTrustedUserCAKeys:
1512 		charptr = &options->trusted_user_ca_keys;
1513 		goto parse_filename;
1514 
1515 	case sRevokedKeys:
1516 		charptr = &options->revoked_keys_file;
1517 		goto parse_filename;
1518 
1519 	case sIPQoS:
1520 		arg = strdelim(&cp);
1521 		if ((value = parse_ipqos(arg)) == -1)
1522 			fatal("%s line %d: Bad IPQoS value: %s",
1523 			    filename, linenum, arg);
1524 		arg = strdelim(&cp);
1525 		if (arg == NULL)
1526 			value2 = value;
1527 		else if ((value2 = parse_ipqos(arg)) == -1)
1528 			fatal("%s line %d: Bad IPQoS value: %s",
1529 			    filename, linenum, arg);
1530 		if (*activep) {
1531 			options->ip_qos_interactive = value;
1532 			options->ip_qos_bulk = value2;
1533 		}
1534 		break;
1535 
1536 	case sVersionAddendum:
1537 		if (cp == NULL)
1538 			fatal("%.200s line %d: Missing argument.", filename,
1539 			    linenum);
1540 		len = strspn(cp, WHITESPACE);
1541 		if (*activep && options->version_addendum == NULL) {
1542 			if (strcasecmp(cp + len, "none") == 0)
1543 				options->version_addendum = xstrdup("");
1544 			else if (strchr(cp + len, '\r') != NULL)
1545 				fatal("%.200s line %d: Invalid argument",
1546 				    filename, linenum);
1547 			else
1548 				options->version_addendum = xstrdup(cp + len);
1549 		}
1550 		return 0;
1551 
1552 	case sHPNDisabled:
1553 		intptr = &options->hpn_disabled;
1554 		goto parse_flag;
1555 
1556 	case sHPNBufferSize:
1557 		intptr = &options->hpn_buffer_size;
1558 		goto parse_int;
1559 
1560 	case sTcpRcvBufPoll:
1561 		intptr = &options->tcp_rcv_buf_poll;
1562 		goto parse_flag;
1563 
1564 #ifdef	NONE_CIPHER_ENABLED
1565 	case sNoneEnabled:
1566 		intptr = &options->none_enabled;
1567 		goto parse_flag;
1568 #endif
1569 
1570 	case sDeprecated:
1571 		logit("%s line %d: Deprecated option %s",
1572 		    filename, linenum, arg);
1573 		while (arg)
1574 		    arg = strdelim(&cp);
1575 		break;
1576 
1577 	case sUnsupported:
1578 		logit("%s line %d: Unsupported option %s",
1579 		    filename, linenum, arg);
1580 		while (arg)
1581 		    arg = strdelim(&cp);
1582 		break;
1583 
1584 	default:
1585 		fatal("%s line %d: Missing handler for opcode %s (%d)",
1586 		    filename, linenum, arg, opcode);
1587 	}
1588 	if ((arg = strdelim(&cp)) != NULL && *arg != '\0')
1589 		fatal("%s line %d: garbage at end of line; \"%.200s\".",
1590 		    filename, linenum, arg);
1591 	return 0;
1592 }
1593 
1594 /* Reads the server configuration file. */
1595 
1596 void
1597 load_server_config(const char *filename, Buffer *conf)
1598 {
1599 	char line[4096], *cp;
1600 	FILE *f;
1601 	int lineno = 0;
1602 
1603 	debug2("%s: filename %s", __func__, filename);
1604 	if ((f = fopen(filename, "r")) == NULL) {
1605 		perror(filename);
1606 		exit(1);
1607 	}
1608 	buffer_clear(conf);
1609 	while (fgets(line, sizeof(line), f)) {
1610 		lineno++;
1611 		if (strlen(line) == sizeof(line) - 1)
1612 			fatal("%s line %d too long", filename, lineno);
1613 		/*
1614 		 * Trim out comments and strip whitespace
1615 		 * NB - preserve newlines, they are needed to reproduce
1616 		 * line numbers later for error messages
1617 		 */
1618 		if ((cp = strchr(line, '#')) != NULL)
1619 			memcpy(cp, "\n", 2);
1620 		cp = line + strspn(line, " \t\r");
1621 
1622 		buffer_append(conf, cp, strlen(cp));
1623 	}
1624 	buffer_append(conf, "\0", 1);
1625 	fclose(f);
1626 	debug2("%s: done config len = %d", __func__, buffer_len(conf));
1627 }
1628 
1629 void
1630 parse_server_match_config(ServerOptions *options,
1631    struct connection_info *connectinfo)
1632 {
1633 	ServerOptions mo;
1634 
1635 	initialize_server_options(&mo);
1636 	parse_server_config(&mo, "reprocess config", &cfg, connectinfo);
1637 	copy_set_server_options(options, &mo, 0);
1638 }
1639 
1640 int parse_server_match_testspec(struct connection_info *ci, char *spec)
1641 {
1642 	char *p;
1643 
1644 	while ((p = strsep(&spec, ",")) && *p != '\0') {
1645 		if (strncmp(p, "addr=", 5) == 0) {
1646 			ci->address = xstrdup(p + 5);
1647 		} else if (strncmp(p, "host=", 5) == 0) {
1648 			ci->host = xstrdup(p + 5);
1649 		} else if (strncmp(p, "user=", 5) == 0) {
1650 			ci->user = xstrdup(p + 5);
1651 		} else if (strncmp(p, "laddr=", 6) == 0) {
1652 			ci->laddress = xstrdup(p + 6);
1653 		} else if (strncmp(p, "lport=", 6) == 0) {
1654 			ci->lport = a2port(p + 6);
1655 			if (ci->lport == -1) {
1656 				fprintf(stderr, "Invalid port '%s' in test mode"
1657 				   " specification %s\n", p+6, p);
1658 				return -1;
1659 			}
1660 		} else {
1661 			fprintf(stderr, "Invalid test mode specification %s\n",
1662 			   p);
1663 			return -1;
1664 		}
1665 	}
1666 	return 0;
1667 }
1668 
1669 /*
1670  * returns 1 for a complete spec, 0 for partial spec and -1 for an
1671  * empty spec.
1672  */
1673 int server_match_spec_complete(struct connection_info *ci)
1674 {
1675 	if (ci->user && ci->host && ci->address)
1676 		return 1;	/* complete */
1677 	if (!ci->user && !ci->host && !ci->address)
1678 		return -1;	/* empty */
1679 	return 0;	/* partial */
1680 }
1681 
1682 /* Helper macros */
1683 #define M_CP_INTOPT(n) do {\
1684 	if (src->n != -1) \
1685 		dst->n = src->n; \
1686 } while (0)
1687 #define M_CP_STROPT(n) do {\
1688 	if (src->n != NULL) { \
1689 		if (dst->n != NULL) \
1690 			xfree(dst->n); \
1691 		dst->n = src->n; \
1692 	} \
1693 } while(0)
1694 #define M_CP_STRARRAYOPT(n, num_n) do {\
1695 	if (src->num_n != 0) { \
1696 		for (dst->num_n = 0; dst->num_n < src->num_n; dst->num_n++) \
1697 			dst->n[dst->num_n] = xstrdup(src->n[dst->num_n]); \
1698 	} \
1699 } while(0)
1700 
1701 /*
1702  * Copy any supported values that are set.
1703  *
1704  * If the preauth flag is set, we do not bother copying the string or
1705  * array values that are not used pre-authentication, because any that we
1706  * do use must be explictly sent in mm_getpwnamallow().
1707  */
1708 void
1709 copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
1710 {
1711 	M_CP_INTOPT(password_authentication);
1712 	M_CP_INTOPT(gss_authentication);
1713 	M_CP_INTOPT(rsa_authentication);
1714 	M_CP_INTOPT(pubkey_authentication);
1715 	M_CP_INTOPT(kerberos_authentication);
1716 	M_CP_INTOPT(hostbased_authentication);
1717 	M_CP_INTOPT(hostbased_uses_name_from_packet_only);
1718 	M_CP_INTOPT(kbd_interactive_authentication);
1719 	M_CP_INTOPT(zero_knowledge_password_authentication);
1720 	M_CP_INTOPT(permit_root_login);
1721 	M_CP_INTOPT(permit_empty_passwd);
1722 
1723 	M_CP_INTOPT(allow_tcp_forwarding);
1724 	M_CP_INTOPT(allow_agent_forwarding);
1725 	M_CP_INTOPT(permit_tun);
1726 	M_CP_INTOPT(gateway_ports);
1727 	M_CP_INTOPT(x11_display_offset);
1728 	M_CP_INTOPT(x11_forwarding);
1729 	M_CP_INTOPT(x11_use_localhost);
1730 	M_CP_INTOPT(max_sessions);
1731 	M_CP_INTOPT(max_authtries);
1732 	M_CP_INTOPT(ip_qos_interactive);
1733 	M_CP_INTOPT(ip_qos_bulk);
1734 
1735 	/* See comment in servconf.h */
1736 	COPY_MATCH_STRING_OPTS();
1737 
1738 	/*
1739 	 * The only things that should be below this point are string options
1740 	 * which are only used after authentication.
1741 	 */
1742 	if (preauth)
1743 		return;
1744 
1745 	M_CP_STROPT(adm_forced_command);
1746 	M_CP_STROPT(chroot_directory);
1747 }
1748 
1749 #undef M_CP_INTOPT
1750 #undef M_CP_STROPT
1751 #undef M_CP_STRARRAYOPT
1752 
1753 void
1754 parse_server_config(ServerOptions *options, const char *filename, Buffer *conf,
1755     struct connection_info *connectinfo)
1756 {
1757 	int active, linenum, bad_options = 0;
1758 	char *cp, *obuf, *cbuf;
1759 
1760 	debug2("%s: config %s len %d", __func__, filename, buffer_len(conf));
1761 
1762 	obuf = cbuf = xstrdup(buffer_ptr(conf));
1763 	active = connectinfo ? 0 : 1;
1764 	linenum = 1;
1765 	while ((cp = strsep(&cbuf, "\n")) != NULL) {
1766 		if (process_server_config_line(options, cp, filename,
1767 		    linenum++, &active, connectinfo) != 0)
1768 			bad_options++;
1769 	}
1770 	xfree(obuf);
1771 	if (bad_options > 0)
1772 		fatal("%s: terminating, %d bad configuration options",
1773 		    filename, bad_options);
1774 }
1775 
1776 static const char *
1777 fmt_multistate_int(int val, const struct multistate *m)
1778 {
1779 	u_int i;
1780 
1781 	for (i = 0; m[i].key != NULL; i++) {
1782 		if (m[i].value == val)
1783 			return m[i].key;
1784 	}
1785 	return "UNKNOWN";
1786 }
1787 
1788 static const char *
1789 fmt_intarg(ServerOpCodes code, int val)
1790 {
1791 	if (val == -1)
1792 		return "unset";
1793 	switch (code) {
1794 	case sAddressFamily:
1795 		return fmt_multistate_int(val, multistate_addressfamily);
1796 	case sPermitRootLogin:
1797 		return fmt_multistate_int(val, multistate_permitrootlogin);
1798 	case sGatewayPorts:
1799 		return fmt_multistate_int(val, multistate_gatewayports);
1800 	case sCompression:
1801 		return fmt_multistate_int(val, multistate_compression);
1802 	case sUsePrivilegeSeparation:
1803 		return fmt_multistate_int(val, multistate_privsep);
1804 	case sProtocol:
1805 		switch (val) {
1806 		case SSH_PROTO_1:
1807 			return "1";
1808 		case SSH_PROTO_2:
1809 			return "2";
1810 		case (SSH_PROTO_1|SSH_PROTO_2):
1811 			return "2,1";
1812 		default:
1813 			return "UNKNOWN";
1814 		}
1815 	default:
1816 		switch (val) {
1817 		case 0:
1818 			return "no";
1819 		case 1:
1820 			return "yes";
1821 		default:
1822 			return "UNKNOWN";
1823 		}
1824 	}
1825 }
1826 
1827 static const char *
1828 lookup_opcode_name(ServerOpCodes code)
1829 {
1830 	u_int i;
1831 
1832 	for (i = 0; keywords[i].name != NULL; i++)
1833 		if (keywords[i].opcode == code)
1834 			return(keywords[i].name);
1835 	return "UNKNOWN";
1836 }
1837 
1838 static void
1839 dump_cfg_int(ServerOpCodes code, int val)
1840 {
1841 	printf("%s %d\n", lookup_opcode_name(code), val);
1842 }
1843 
1844 static void
1845 dump_cfg_fmtint(ServerOpCodes code, int val)
1846 {
1847 	printf("%s %s\n", lookup_opcode_name(code), fmt_intarg(code, val));
1848 }
1849 
1850 static void
1851 dump_cfg_string(ServerOpCodes code, const char *val)
1852 {
1853 	if (val == NULL)
1854 		return;
1855 	printf("%s %s\n", lookup_opcode_name(code), val);
1856 }
1857 
1858 static void
1859 dump_cfg_strarray(ServerOpCodes code, u_int count, char **vals)
1860 {
1861 	u_int i;
1862 
1863 	for (i = 0; i < count; i++)
1864 		printf("%s %s\n", lookup_opcode_name(code), vals[i]);
1865 }
1866 
1867 static void
1868 dump_cfg_strarray_oneline(ServerOpCodes code, u_int count, char **vals)
1869 {
1870 	u_int i;
1871 
1872 	printf("%s", lookup_opcode_name(code));
1873 	for (i = 0; i < count; i++)
1874 		printf(" %s",  vals[i]);
1875 	printf("\n");
1876 }
1877 
1878 void
1879 dump_config(ServerOptions *o)
1880 {
1881 	u_int i;
1882 	int ret;
1883 	struct addrinfo *ai;
1884 	char addr[NI_MAXHOST], port[NI_MAXSERV], *s = NULL;
1885 
1886 	/* these are usually at the top of the config */
1887 	for (i = 0; i < o->num_ports; i++)
1888 		printf("port %d\n", o->ports[i]);
1889 	dump_cfg_fmtint(sProtocol, o->protocol);
1890 	dump_cfg_fmtint(sAddressFamily, o->address_family);
1891 
1892 	/* ListenAddress must be after Port */
1893 	for (ai = o->listen_addrs; ai; ai = ai->ai_next) {
1894 		if ((ret = getnameinfo(ai->ai_addr, ai->ai_addrlen, addr,
1895 		    sizeof(addr), port, sizeof(port),
1896 		    NI_NUMERICHOST|NI_NUMERICSERV)) != 0) {
1897 			error("getnameinfo failed: %.100s",
1898 			    (ret != EAI_SYSTEM) ? gai_strerror(ret) :
1899 			    strerror(errno));
1900 		} else {
1901 			if (ai->ai_family == AF_INET6)
1902 				printf("listenaddress [%s]:%s\n", addr, port);
1903 			else
1904 				printf("listenaddress %s:%s\n", addr, port);
1905 		}
1906 	}
1907 
1908 	/* integer arguments */
1909 #ifdef USE_PAM
1910 	dump_cfg_int(sUsePAM, o->use_pam);
1911 #endif
1912 	dump_cfg_int(sServerKeyBits, o->server_key_bits);
1913 	dump_cfg_int(sLoginGraceTime, o->login_grace_time);
1914 	dump_cfg_int(sKeyRegenerationTime, o->key_regeneration_time);
1915 	dump_cfg_int(sX11DisplayOffset, o->x11_display_offset);
1916 	dump_cfg_int(sMaxAuthTries, o->max_authtries);
1917 	dump_cfg_int(sMaxSessions, o->max_sessions);
1918 	dump_cfg_int(sClientAliveInterval, o->client_alive_interval);
1919 	dump_cfg_int(sClientAliveCountMax, o->client_alive_count_max);
1920 
1921 	/* formatted integer arguments */
1922 	dump_cfg_fmtint(sPermitRootLogin, o->permit_root_login);
1923 	dump_cfg_fmtint(sIgnoreRhosts, o->ignore_rhosts);
1924 	dump_cfg_fmtint(sIgnoreUserKnownHosts, o->ignore_user_known_hosts);
1925 	dump_cfg_fmtint(sRhostsRSAAuthentication, o->rhosts_rsa_authentication);
1926 	dump_cfg_fmtint(sHostbasedAuthentication, o->hostbased_authentication);
1927 	dump_cfg_fmtint(sHostbasedUsesNameFromPacketOnly,
1928 	    o->hostbased_uses_name_from_packet_only);
1929 	dump_cfg_fmtint(sRSAAuthentication, o->rsa_authentication);
1930 	dump_cfg_fmtint(sPubkeyAuthentication, o->pubkey_authentication);
1931 #ifdef KRB5
1932 	dump_cfg_fmtint(sKerberosAuthentication, o->kerberos_authentication);
1933 	dump_cfg_fmtint(sKerberosOrLocalPasswd, o->kerberos_or_local_passwd);
1934 	dump_cfg_fmtint(sKerberosTicketCleanup, o->kerberos_ticket_cleanup);
1935 # ifdef USE_AFS
1936 	dump_cfg_fmtint(sKerberosGetAFSToken, o->kerberos_get_afs_token);
1937 # endif
1938 #endif
1939 #ifdef GSSAPI
1940 	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
1941 	dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
1942 #endif
1943 #ifdef JPAKE
1944 	dump_cfg_fmtint(sZeroKnowledgePasswordAuthentication,
1945 	    o->zero_knowledge_password_authentication);
1946 #endif
1947 	dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
1948 	dump_cfg_fmtint(sKbdInteractiveAuthentication,
1949 	    o->kbd_interactive_authentication);
1950 	dump_cfg_fmtint(sChallengeResponseAuthentication,
1951 	    o->challenge_response_authentication);
1952 	dump_cfg_fmtint(sPrintMotd, o->print_motd);
1953 	dump_cfg_fmtint(sPrintLastLog, o->print_lastlog);
1954 	dump_cfg_fmtint(sX11Forwarding, o->x11_forwarding);
1955 	dump_cfg_fmtint(sX11UseLocalhost, o->x11_use_localhost);
1956 	dump_cfg_fmtint(sStrictModes, o->strict_modes);
1957 	dump_cfg_fmtint(sTCPKeepAlive, o->tcp_keep_alive);
1958 	dump_cfg_fmtint(sEmptyPasswd, o->permit_empty_passwd);
1959 	dump_cfg_fmtint(sPermitUserEnvironment, o->permit_user_env);
1960 	dump_cfg_fmtint(sUseLogin, o->use_login);
1961 	dump_cfg_fmtint(sCompression, o->compression);
1962 	dump_cfg_fmtint(sGatewayPorts, o->gateway_ports);
1963 	dump_cfg_fmtint(sUseDNS, o->use_dns);
1964 	dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
1965 	dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
1966 
1967 	/* string arguments */
1968 	dump_cfg_string(sPidFile, o->pid_file);
1969 	dump_cfg_string(sXAuthLocation, o->xauth_location);
1970 	dump_cfg_string(sCiphers, o->ciphers);
1971 	dump_cfg_string(sMacs, o->macs);
1972 	dump_cfg_string(sBanner, o->banner);
1973 	dump_cfg_string(sForceCommand, o->adm_forced_command);
1974 	dump_cfg_string(sChrootDirectory, o->chroot_directory);
1975 	dump_cfg_string(sTrustedUserCAKeys, o->trusted_user_ca_keys);
1976 	dump_cfg_string(sRevokedKeys, o->revoked_keys_file);
1977 	dump_cfg_string(sAuthorizedPrincipalsFile,
1978 	    o->authorized_principals_file);
1979 	dump_cfg_string(sVersionAddendum, o->version_addendum);
1980 
1981 	/* string arguments requiring a lookup */
1982 	dump_cfg_string(sLogLevel, log_level_name(o->log_level));
1983 	dump_cfg_string(sLogFacility, log_facility_name(o->log_facility));
1984 
1985 	/* string array arguments */
1986 	dump_cfg_strarray_oneline(sAuthorizedKeysFile, o->num_authkeys_files,
1987 	    o->authorized_keys_files);
1988 	dump_cfg_strarray(sHostKeyFile, o->num_host_key_files,
1989 	     o->host_key_files);
1990 	dump_cfg_strarray(sHostKeyFile, o->num_host_cert_files,
1991 	     o->host_cert_files);
1992 	dump_cfg_strarray(sAllowUsers, o->num_allow_users, o->allow_users);
1993 	dump_cfg_strarray(sDenyUsers, o->num_deny_users, o->deny_users);
1994 	dump_cfg_strarray(sAllowGroups, o->num_allow_groups, o->allow_groups);
1995 	dump_cfg_strarray(sDenyGroups, o->num_deny_groups, o->deny_groups);
1996 	dump_cfg_strarray(sAcceptEnv, o->num_accept_env, o->accept_env);
1997 
1998 	/* other arguments */
1999 	for (i = 0; i < o->num_subsystems; i++)
2000 		printf("subsystem %s %s\n", o->subsystem_name[i],
2001 		    o->subsystem_args[i]);
2002 
2003 	printf("maxstartups %d:%d:%d\n", o->max_startups_begin,
2004 	    o->max_startups_rate, o->max_startups);
2005 
2006 	for (i = 0; tunmode_desc[i].val != -1; i++)
2007 		if (tunmode_desc[i].val == o->permit_tun) {
2008 			s = tunmode_desc[i].text;
2009 			break;
2010 		}
2011 	dump_cfg_string(sPermitTunnel, s);
2012 
2013 	printf("ipqos %s ", iptos2str(o->ip_qos_interactive));
2014 	printf("%s\n", iptos2str(o->ip_qos_bulk));
2015 
2016 	channel_print_adm_permitted_opens();
2017 }
2018